JP7718092B2 - Communication device and computer program for communication device - Google Patents

Description

The technology disclosed in this specification relates to a communication device that can be connected to an external device.

As shown in Non-Patent Document 1, the Wi-Fi Alliance (registered trademark) has developed WPA3, a new communication standard for Wi-Fi systems. WPA3 provides next-generation security protocols. Furthermore, other security protocols may also be provided for communication standards other than WPA3.

Japanese Patent Application Laid-Open No. 2016-019085 Japanese Patent Application Laid-Open No. 2016-208448 JP 2019-106610 A

“WPA3 Specification Version 3.0” Wi-Fi Alliance, 2020, https://www.wi-fi.org/ja/discover-wi-fi/security

With the development of new communication standards, it is anticipated that various communication standards will coexist. This specification discloses technology for appropriately receiving services provided by specific communication standards in such a mixed environment.

A communication device disclosed in the present specification includes a communication interface, an operation unit, and a first change unit that, when the operation unit receives an instruction to establish a first connection with a first external device via the communication interface while the communication device is in a first state, changes the state of the communication device from the first state to a second state different from the first state, wherein the first state is a state that permits use of both the first connection and use of a second connection with a second external device via the communication interface, the second state is a state that permits use of the first connection but does not permit use of the second connection, the first connection is a connection conforming to a first communication standard, and the second connection is a wireless connection conforming to a second communication standard different from the first communication standard.
The first changer.

When the operation unit receives an instruction to establish a connection according to the first communication standard, it is assumed that the user of the communication device wishes to receive services provided by the first communication standard. According to the above configuration, when it is assumed that the user of the communication device wishes to receive services provided by the first communication standard, the state of the communication device is changed from the first state to the second state. In the second state, use of the first connection according to the first communication standard is permitted, but use of the second connection according to the second communication standard is not permitted. In a situation where the first standard and the second standard coexist, it is possible to appropriately receive services provided by the first communication standard.

Another communication device disclosed in this specification includes a communication interface, an operation unit, and a control unit that causes the communication device to operate in a third state when the operation unit receives an instruction to establish a first connection with a first external device via the communication interface, and causes the communication device to operate in a fourth state when the operation unit receives an instruction to establish a second connection with a second external device via the communication interface, wherein the third state is a state in which use of the first connection is permitted but use of the second connection is not permitted, and the fourth state is a state in which use of both the first connection and the second connection is permitted, the first connection being a connection conforming to a first communication standard, and the second connection being a connection conforming to a second communication standard different from the first communication standard.

When the operation unit receives an instruction to establish a first connection according to the first communication standard, it is presumed that the user of the communication device wishes to receive services provided by the first communication standard. According to the above configuration, when it is presumed that the user of the communication device wishes to receive services provided by the first communication standard, the control unit causes the communication device to operate in the third state. In the third state, use of the first connection according to the first communication standard is permitted, but use of the second connection according to the second communication standard is not permitted. In a situation where the first communication standard and the second communication standard coexist, it is possible to appropriately receive services provided by the first communication standard.

Furthermore, when the operation unit receives an instruction to establish a connection according to the second communication standard, it is presumed that the user of the communication device wishes to receive services provided by the second communication standard. According to the above configuration, when it is presumed that the user of the communication device wishes to receive services provided by the second communication standard, the control unit causes the communication device to operate in the fourth state. In the fourth state, not only is the use of the first connection according to the first communication standard permitted, but the use of the second connection according to the second communication standard is also permitted. In a situation where the first communication standard and the second communication standard coexist, it is possible to appropriately receive services provided by the second communication standard.

In addition, the above-mentioned communication device control method, computer program for the communication device, and storage medium for storing the computer program are also novel and useful.

1 shows the configuration of a communication system. 10 shows a sequence diagram of a case C1 in which no WPA3-incompatible AP exists. 10 shows a sequence diagram of a case C2 in which an AP that does not support WPA3 is present. A sequence diagram of Case C3, which is a continuation of Case C1, is shown. An example problem is shown below. A sequence diagram of case C4 that addresses the example problem of FIG. 5 is shown. 1 shows a table representing the relationship between APs and MFPs in the first embodiment. 10A and 10B are sequence diagrams illustrating specific cases in the second embodiment. 10 shows a table representing the relationship between APs and MFPs in the second embodiment. 10 shows the configuration of a communication system according to a third embodiment. 13 shows a sequence diagram of a specific case in the third embodiment. 10 shows the configuration of a communication system according to a fourth embodiment. 13 shows a sequence diagram of a specific case in the fourth embodiment. 13 shows a table representing the relationship between APs and servers in the fourth embodiment.

(First Example)
(Configuration of communication system 2; Figure 1)
As shown in FIG. 1 , the communication system 2 includes an MFP (abbreviation for Multifunction Peripheral) 10, a terminal device 100, and APs (abbreviation for Access Point) 200 and 300. Each of the APs 200 and 300 is capable of forming a wireless LAN (abbreviation for Local Area Network). The MFP 10 is connected to the wireless LAN formed by the AP (e.g., 200) and can communicate with other devices (e.g., terminal device 100) connected to the wireless LAN. The terminal device 100 is a mobile terminal, a desktop PC, a notebook PC, or the like.

(Configuration of MFP 10; Figure 1)
The MFP 10 is a peripheral device (for example, a peripheral device of the terminal device 100) that can perform functions such as printing and scanning. The MFP 10 includes an operation unit 12, a display unit 14, a Wi-Fi interface 16, a print execution unit 20, a scan execution unit 22, and a control unit 30. Each of the units 12 to 30 is connected to a bus line (reference numerals omitted). Below, the interface will be simply referred to as "I/F."

The operation unit 12 has multiple keys. By operating the operation unit 12, the user can input various instructions to the MFP 10. The display unit 14 is a display for displaying various information. Note that the display unit 14 may also function as a touch panel (i.e., the operation unit 12).

The Wi-Fi I/F 16 is a wireless I/F for performing wireless communication in accordance with the Wi-Fi (registered trademark) standard. The Wi-Fi standard is a standard for performing wireless communication in accordance with, for example, the IEEE (The Institute of Electrical and Electronics Engineers, Inc.) 802.11 standard and equivalent standards (e.g., 802.11a, 11b, 11g, 11n, etc.).

The Wi-Fi I/F 16 also supports WPA3 Personal and Enterprise. Personal is a method for authenticating a client station in a small-scale wireless LAN, such as that used in a home. Enterprise is a method for authenticating a client station in a large-scale wireless LAN, such as that used in a company. With Enterprise, an authentication server (see the third embodiment) that performs authentication in accordance with IEEE 802.1X authenticates a client station in accordance with the Wi-Fi standard. On the other hand, with Personal, an authentication server is not used; instead, the AP authenticates the client station using, for example, PSK (short for Pre-Shared Key).

WPA3 is a communications standard established by the Wi-Fi Alliance (registered trademark) as the successor to WPA2. WPA3 provides next-generation security protocols. For example, WPA3 provides a new method for authenticating client stations, SAE (short for Simultaneous Authentication of Equals).

Furthermore, in WPA3, wireless connections are protected by PMF (short for Protected Management Frames). On the other hand, in WPA2, wireless connections may or may not be protected by PMF.

The print execution unit 20 has a printing mechanism such as an inkjet or laser printing mechanism. The scan execution unit 22 has a scanning mechanism such as a CCD (Charge Coupled Device) image sensor or a CIS (Contact Image Sensor).

The control unit 30 includes a CPU 32 and a memory 34. The CPU 32 executes various processes in accordance with a program 40 stored in the memory 34. The memory 34 is composed of volatile memory, non-volatile memory, etc.

Memory 34 also stores WPA3 setting information 42. WPA3 setting information 42 indicates one of multiple settings, including the setting "WPA3 Transition Mode" and the setting "WPA3 Only Mode." The setting "WPA3 Transition Mode" is a setting that allows the establishment of both wireless connections according to WPA3 and WPA2. For example, the setting "WPA3 Transition Mode" allows both authentication of a client station using PSK and authentication of a client station using SAE. Here, PSK is a method that can be used in standards prior to WPA2. The setting "WPA3 Only Mode" is a setting that allows the establishment of wireless connections according to WPA3 but not WPA2. For example, with the setting "WPA3 Only Mode," authentication of child stations using PSK is not permitted, but authentication of child stations using SAE is permitted.

When the MFP 10 is shipped, the WPA3 setting information 42 indicates the setting "WPA3 Transition Mode." After the MFP 10 is turned on for the first time, the WPA3 setting information 42 indicates the setting "WPA3 Transition Mode" by default. In a modified example, the default for the WPA3 setting information 42 may be a setting other than both the setting "WPA3 Transition Mode" and the setting "WPA3 Only Mode" (for example, a setting that uses only WPA2).

(Configuration of APs 200 and 300; Figure 1)
The AP 200 does not support WPA3. The AP 200 supports WPA2. In the following, not supporting WPA3 may be referred to as "not supporting WPA3." The AP 200 stores an SSID (short for Service Set Identifier) "ap01" that identifies the wireless network formed by the AP 200, and a password "xxxx" that is used in the wireless network.

AP300 supports WPA3. Hereinafter, support for WPA3 may be referred to as "WPA3 compatible." AP300 stores the same SSID "ap01" as AP200 and the password "yyyy" used in the wireless network formed by AP300. In a modified example, AP300's password may be the same as AP200's password "xxxx."

(Case C1; Figure 2)
Referring to FIG. 2 , a specific case C1 realized by the communication system 2 of this embodiment will be described. In this case, a wireless connection is established between the MFP 10 and an AP in a situation where there are no APs incompatible with WPA3 in the vicinity of the MFP 10. In this case and in cases C2 to C4 in FIGS. 3 to 6 described below, WPA3 Personal is used. In the initial stage of this case, the WPA3 setting information 42 of the MFP 10 indicates the setting "WPA3 Transition Mode" by default. Note that in the first embodiment and the second and third embodiments described below, all of the following communications performed by the MFP 10 are performed via the Wi-Fi I/F 16. In the following description of communication-related processes, the phrase "via the Wi-Fi I/F 16" may be omitted. In addition, in the following, for ease of understanding, the operations performed by the CPU of each device (e.g., CPU 32, etc.) may be described not as being primarily about the CPU, but as being primarily about each device (e.g., MFP 10).

When the MFP 10 receives an instruction to establish a wireless connection on the operation unit 12 at T10, it broadcasts a probe request to the outside at T12 to search for APs present around the MFP 10. In this case, there is a WPA3-compatible AP 300 around the MFP 10, and no other APs. Therefore, at T14, the MFP 10 receives a probe response to the probe request from only one AP 300. The probe response includes the SSID "ap01" of the AP 300 and WPA3 compatibility information indicating that the AP 300 supports WPA3. The WPA3 compatibility information includes, for example, information indicating the use of SAE.

At the next T20, the MFP 10 displays a selection screen for selecting one AP from one or more APs (hereinafter referred to as "one or more surrounding APs") that exist around the MFP 10. For each of the one or more surrounding APs, the selection screen includes the SSID in the Probe response received from that AP, a button for selecting that SSID, and a message indicating whether that AP supports WPA3. In this case, the selection screen includes only the SSID "ap01" of AP 300. In addition to the list of SSIDs, the selection screen also includes an input field for the AP's password.

At T22, the user operates the operation unit 12 of the MFP 10 to select the SSID "ap01" on the selection screen and enter the password "yyyy."

When the MFP 10 receives the selection of the SSID "ap01" of the WPA3-compatible AP 300 and the input of the password "yyyy" at T22, it determines at T24 whether a WPA3-incompatible AP exists among one or more surrounding APs in addition to a WPA3-compatible AP. Specifically, the MFP 10 determines whether a probe response not containing WPA3 compatibility information (hereinafter referred to as a "non-compatible probe response") exists among one or more probe responses received from one or more surrounding APs in addition to a probe response containing WPA3 compatibility information. If a non-compatible probe response exists among one or more probe responses, the MFP 10 determines that a WPA3-incompatible AP exists among one or more surrounding APs. On the other hand, if a non-compatible probe response does not exist among one or more probe responses, the MFP 10 determines that a WPA3-incompatible AP does not exist among one or more surrounding APs. If a WPA3-incompatible AP is selected, the processes of T24 and T26 are not executed, and a process for establishing a wireless connection with the WPA3-incompatible AP is executed (see T230 to T250 in FIG. 4). Also, if only WPA3-incompatible APs exist among one or more surrounding APs, the processes of T24 and T26 are not executed.

In this case, there is one WPA3-compatible AP 300 around the MFP 10, and no WPA3-incompatible APs. In this case, the MFP 10 determines in T24 that there is no WPA3-incompatible AP among one or more surrounding APs, and proceeds to processing in T26. Here, a case where one or more surrounding APs include a WPA3-incompatible AP in addition to a WPA3-compatible AP will be described later with reference to FIG. 3.

At T26, the MFP 10 changes the WPA3 setting information 42 from the setting "WPA3 Transition Mode" to the setting "WPA3 Only Mode."

At T30, authentication communication is performed between the MFP 10 and the AP 300 selected at T22, allowing the AP 300 to authenticate the MFP 10. During authentication, authentication is performed according to SAE, and if the authentication is successful, an encryption key generated using the password "yyyy" entered at T22 is provided to both the AP 300 and the MFP 10. After the authentication communication is successful, association communication (not shown) is performed.

At T40, the MFP 10 performs 4-way handshake communication with the AP 300 using the encryption key provided at T30. As a result, at T50, a wireless connection is established between the MFP 10 and the AP 300 for wireless communication in accordance with the Wi-Fi standard. Also, in this case, the WPA3 setting information 42 of the MFP 10 indicates the setting "WPA3 Only Mode," and the AP 300 supports WPA3. Therefore, in this case, 4-way handshake communication is performed for management by the PMF. The wireless connection of T50 is then managed by the PMF.

For example, in a situation where both the MFP 10 and the terminal device 100 are connected to a wireless LAN formed by the AP 300, the terminal device 100 sends print data indicating the image to be printed to the MFP 10 via the AP 300 at T60.

When the MFP 10 receives print data from the terminal device 100 in T60, it causes the print execution unit 20 to print the image indicated by the received print data in T62.

For example, consider a situation in which a malicious third party attempts to connect MFP 10 to a wireless network formed by AP 800 prepared by the third party, instead of AP 300. The SSID of AP 800 is set to "ap01," the same as the SSID of AP 300. AP 800 is a non-WPA3 AP and does not support the security protocols provided by WPA3. As a result, AP 800 has weaker security than AP 300. For example, the third party may attempt to intercept communications using AP 800, which has weak security.

In the above situation, the third party first disrupts communication between the AP 300 and the MFP 10, disconnecting the wireless connection between the AP 300 and the MFP 10. The MFP 10 detects the disconnection of the wireless connection at T70. To attempt to re-establish the wireless connection, the MFP 10 broadcasts a Probe request to the outside at T72. At T74, because communication with the AP 300 has been disrupted, the MFP 10 receives a Probe response to the Probe request from the AP 800. The Probe response includes the SSID "ap01" and WPA3 non-compatibility information indicating that the AP 800 supports standards earlier than WPA2.

In this case, at T26 above, the WPA3 setting information 42 is changed to the setting "WPA3 Only Mode." As described above, the setting "WPA3 Only Mode" does not allow authentication of a client station using PSK, but does allow authentication of a client station using SAE. In this case, because the AP 800 does not support WPA3, the AP 800 attempts to authenticate the client station using PSK. However, because the MFP 10 does not allow authentication of a client station using PSK, this authentication fails. As a result, the establishment of a wireless connection between the AP 800 and the MFP 10 fails.

For example, consider a comparative example in which the above-mentioned process of T26 is not performed and the WPA3 setting information 42 remains set to the "WPA3 Transition Mode" setting. As described above, the "WPA3 Transition Mode" setting allows both authentication of the client station using PSK and authentication of the client station using SAE. Therefore, in this comparative example, the authentication of the client station using PSK attempted by the AP 800 is successful, and a wireless connection can be established between the AP 800 and the MFP 10. In contrast, in this case, a wireless connection is not established between the AP 800 and the MFP 10, preventing a third party from intercepting communications using the AP 800.

Furthermore, when the operation unit 12 receives an instruction to establish a wireless connection with AP300, i.e., when the user selects SSID "ap01" at T22, it is assumed that the user wishes to receive services provided by WPA3 SAE (i.e., communications with relatively high encryption strength). According to this case, when it is assumed that the user wishes to receive services provided by SAE (T22), the WPA3 setting information 42 is changed from the setting "WPA3 Transition Mode" to the setting "WPA3 Only Mode" (T26). In a situation where WPA3 SAE and PSK (pre-WPA2) coexist, it is possible to properly receive services provided by WPA3 SAE.

(Case C2; Figure 3)
Another specific case C2 will be described with reference to Fig. 3. This case is a case in which a wireless connection is established between the MFP 10 and an AP in a situation where both a WPA3-incompatible AP and a WPA3-compatible AP are present around the MFP 10. The initial stage of this case is similar to case C1 in Fig. 2.

T110, T112A, and T112B are the same as T10 and T12 in Figure 2. In this case, there are two APs 200 and 300 around the MFP 10, with AP 200 being a WPA3-incompatible AP and AP 300 being a WPA3-compatible AP. Therefore, at T114A and T114B, the MFP 10 receives a probe response from each of the two APs 200 and 300. The probe response from AP 200 includes the SSID "ap01" and WPA3 non-compatibility information.

In T120, the MFP 10 displays a selection screen including two SSIDs, "ap01." T122 is the same as T20 in Figure 2.

At T124, the MFP 10 performs the same determination as at T24 in FIG. 2. In this case, in addition to the WPA3-compatible AP 300, a WPA3-incompatible AP 200 is present around the MFP 10. Therefore, at T124, the MFP 10 determines that, in addition to the WPA3-compatible AP 300, a WPA3-incompatible AP is present among one or more surrounding APs, and proceeds to T126.

In T126, the MFP 10 determines whether the SSID of one or more surrounding APs that does not support WPA3 is the same as the SSID of the WPA3-compatible AP selected in T122. In this case, the SSID "ap01" of AP300 is the same as the SSID "ap01" of AP200. Therefore, the MFP 10 determines that the two SSIDs are the same and skips the process of T26 in FIG. 2. That is, the WPA3 setting information 42 is maintained at the setting "WPA3 Transition Mode." T130 to T150 are the same as T20 to T50 in FIG. 2. On the other hand, if it is determined that the two SSIDs are not the same, the MFP 10 performs the same processes as T26 to T50 in FIG. 2. Note that, in a modified example, the determination of T126 may be performed before the determination of T124.

As described above, AP200 and AP300 are assigned the same SSID, "ap01." AP200 is, for example, an AP installed by a user before AP300 is installed. For example, in a situation where not only a WPA3-compatible AP300 but also a WPA3-incompatible AP200 are present around MFP10, if the SSID of the WPA3-compatible AP300 is selected, a comparative example is assumed in which the WPA3 setting information 42 is changed to the setting "WPA3 Only Mode." In this comparative example, a situation is assumed in which MFP10 is moved away from AP300 after a wireless connection with AP300 is established. In this case, the wireless connection with AP300 is disconnected, and MFP10 attempts to connect to another wireless network identified by the same SSID, "ap01," (i.e., the wireless network formed by AP200). However, because the WPA3 setting information 42 has been changed to the setting "WPA3 Only Mode," the MFP 10 fails to establish a wireless connection with the AP 200, even though the previous AP 200 is present around the MFP 10. In contrast, in this case, the WPA3 setting information 42 is maintained in the setting "WPA3 Transition Mode." As described above, the setting "WPA3 Transition Mode" allows the establishment of a wireless connection with an AP that does not support WPA3. This makes it possible to prevent, for example, failures in establishing a wireless connection with the previous AP 200, thereby ensuring user convenience. Note that the above comparative example may also be adopted in a modified example.

(Case C3; Figure 4)
4, a case C3 following T50 in case C1 in FIG. 2 will be described. In this case, after a wireless connection with AP 300 is established in T50, AP 200 that does not support WPA3 is installed around MFP 10. In the initial stage of this case, WPA3 setting information 42 of MFP 10 indicates the setting "WPA3 Only Mode."

T210 to T220 are the same as T110 to T120 in Figure 3. At T222, the user selects the SSID "ap01" of the non-WPA3 AP200 on the selection screen and enters the password "xxxx".

In T226, the MFP 10 changes the WPA3 setting information 42 from the setting "WPA3 Only Mode" to the setting "WPA3 Transition Mode." T230 is the same as T30 in FIG. 2 except that authentication according to PSK is performed. T240 and T250 are the same as T40 and T50 in FIG. 2. Note that in a modified example, communication for management by the PMF does not have to be performed in T240.

In this case, after a wireless connection with AP300 is established, the selection of the SSID "ap01" of AP200, which does not support WPA3, on the selection screen indicates that the user wishes to receive services provided by WPA2 PSK. According to this case, when it is determined that the user wishes to receive services provided by PSK (T222), the WPA3 setting information 42 is changed from the setting "WPA3 Only Mode" to the setting "WPA3 Transition Mode" (T226). In a situation where WPA3 SAE and pre-WPA2 PSK are mixed, services provided by PSK can be properly received.

(Example problem)
With reference to FIG. 5 , an example problem will be described to further illustrate the effects of this embodiment. In this example problem, the WPA3 setting information of the MFP 850 indicates the setting "WPA3 Transition Mode," and the WPA3 setting information of the MFP 850 is not changed. In this example problem, a third party prepares an AP 900 and attempts to connect the MFP 850 to a wireless network formed by the AP 900. The SSID of the AP 900 is set to "ap01," the same as the SSID of the AP 300. The AP 900 is a WPA3-compatible AP.

Y10 to Y22 are the same as T10 to T22 in Figure 2, except that the MFP 850 and AP 900 are used. Y30 to Y34 show the details of SAE authentication in this problem example. At Y30, the MFP 850 executes Commit communication with the AP 900. During the Commit communication, the MFP 850 sends a signal to the AP 900 requesting execution of SAE. If the AP 900 accepts the request in this signal, SAE authentication is successful. However, in this problem example, the AP 900 is designed by a third party to ignore the request in this signal. Therefore, at Y34, the MFP 850 receives a Confirm Failed signal from the AP 900, indicating that SAE authentication has failed.

In this example problem, the WPA3 setting information of the MFP 850 indicates the setting "WPA3 Transition Mode." Therefore, at Y36, the MFP 850 performs PSK authentication instead of SAE authentication. Y40 and Y50 are similar to T40 and T50 in Figure 2, except that an encryption key generated using PSK is used. Although the AP 900 supports WPA3, it operates as an AP that does not support WPA3. A third party may, for example, attempt to intercept communications using the AP 900, which has weak security.

(Case C4; Figure 6)
With reference to FIG. 6 , case C4, which addresses the problem example of FIG. 5 in this embodiment, will be described. T310 to T326 are similar to T10 to T26 in FIG. 2 , except that an AP 900 prepared by a third party is used. T330 and T334 are similar to Y30 and Y34 in FIG. 5 , except that the MFP 10 is used. In this case, when T334 is executed, the WPA3 setting information 42 is changed to the setting "WPA3 Only Mode" (T326). Therefore, the MFP 10 does not execute PSK authentication instead of SAE authentication. In T336, the MFP 10 displays a connection error on the display unit 14, indicating that the wireless connection establishment failed.

For example, as shown in T24A and T26A in Figure 2, a comparative example is assumed in which the WPA3 setting information 42 is changed to the setting "WPA3 Only Mode" after the wireless connection is established at T50. In this comparative example, the WPA3 setting information 42 indicates the setting "WPA3 Transition Mode" when authentication is performed. This could result in the problem example in Figure 5. In contrast, with the configuration of this embodiment, the WPA3 setting information 42 indicates the setting "WPA3 Only Mode" when authentication is performed, thereby preventing the problem example in Figure 5 from occurring. Note that the above comparative example may also be adopted in a modified example, and this comparative example can also prevent a third party from eavesdropping on communications using the AP 800, similar to T70 to T74 in Figure 2.

(Table showing the relationship between APs and MFPs; FIG. 7)
As shown in FIG. 7 , with the establishment of WPA3, there may be APs that are not WPA3-compatible but support WPA or WPA2, APs that are WPA3-compatible and support WPA3 Transition Mode, and APs that are WPA3-compatible and support WPA3 Only Mode.

On the other hand, there may be MFPs that do not support WPA3, MFPs that support WPA3 but operate in WPA3 Transition Mode, and MFPs that support WPA3 but operate in WPA3 Only Mode.

In this embodiment, the WPA3 setting information 42 of the MFP 10 is changed to the setting "WPA3 Only Mode" (T26 in Figure 2). As a result, the MFP 10 can establish a wireless connection with either a WPA3-compatible AP that supports WPA3 Transition Mode, or a WPA3-compatible AP that supports WPA3 Only Mode. WPA3 is used in both cases. On the other hand, the MFP 10 cannot establish a wireless connection with an AP that does not support WPA3.

(Correspondence)
The MFP 10, the operation unit 12, the Wi-Fi I/F 16, the print execution unit 20, and the control unit 30 are examples of a "communication device," a "communication interface," an "operation unit," an "image processing execution unit," and a "control unit," respectively. The AP 300 and the AP 200 are examples of a "first external device" and a "second external device." WPA3 Transition and WPA3 Only Mode are examples of a "first state (and a fourth state)" and a "second state (and a second state)," respectively. SAE and PSK are examples of a "first communication standard" and a "second communication standard," respectively. T22 in FIG. 2 and T222 in FIG. 4 are examples of an "instruction to establish a first connection" and an "instruction to establish a second connection," respectively. WPA3 compatibility information and WPA3 non-compatibility information are examples of "standard information." The print data of T60 in FIG. 2 is an example of a "specific request." T26 in FIG. 2 is an example of a process realized by the "first change unit."

(Second Example)
(Configuration of communication system 2; Figure 1)
The communication system 2 of this embodiment is similar to that of the first embodiment, except for the following points. The APs 200 and 300 of this embodiment are APs that do not support WPA3 and support WPA2. The AP 200 operates in PMF Capable mode. The AP 300 operates in PMF Required mode. Hereinafter, operation in PMF Required mode may be referred to as "PR operation," and not operation in PMF Required may be referred to as "PR non-operation." In a modified example, the AP 300 may be a WPA3-compatible AP.

The memory 34 of the MFP 10 stores PMF setting information 44 instead of WPA3 setting information 42. The PMF setting information 44 indicates one of multiple settings, including the setting "PMF Capable" and the setting "PMF Required." The setting "PMF Capable" is a setting that allows both the establishment of a wireless connection that does not use PMF and the establishment of a wireless connection that uses PMF. The setting "PMF Required" is a setting that allows the establishment of a wireless connection that uses PMF, but does not allow the establishment of a wireless connection that does not use PMF.

(Specific case of this embodiment; Figure 8)
A specific case of this embodiment will be described with reference to Fig. 8. In the initial stage of this case, the PMF setting information 44 of the MFP 10 indicates the setting "PMF Capable" by default.

T410 and T412 are the same as T10 and T12 in Figure 2. T414 is the same as T14 in Figure 2, except that the probe response includes PMF information. PMF information is information indicating that AP 300, which sent the probe response, is operating with PMF Required. If the AP, which sent the probe response, is not operating with PMF Required, the probe response does not include PMF information.

T420 is similar to T20 in Figure 2, except that it includes a message indicating whether the AP that sent the Probe response is an AP operating PR. T422 is similar to T22 in Figure 2.

In T424, the MFP 10 determines whether there is an AP with PR inoperative among one or more surrounding APs. Specifically, the MFP 10 determines whether there is a Probe response that does not include PMF information among one or more Probe responses received from one or more surrounding APs. In this case, there is one AP 300 with PR inoperative around the MFP 10, and no APs with PR inoperative. In this case, the MFP 10 determines in T424 that there is no AP with PR inoperative among one or more surrounding APs, and proceeds to processing in T426. Note that if it is determined that there is an AP with PR inoperative among one or more surrounding APs, the MFP 10 skips processing in T426 and proceeds to processing in T430 (see Figure 3 of the first embodiment).

At T426, the MFP 10 changes the PMF setting information 44 from "PMF Capable" to "PMF Required." T430 to T450 are the same as T30 to T50 in Figure 2.

In this case, as in Figure 2, a malicious third party prepares AP910 with the purpose of eavesdropping on communications. AP910 is an AP with PR disabled and operates with PMF Disable. PMF Disable is a setting that allows the establishment of wireless connections that do not use PMF, but does not allow the establishment of wireless connections that do use PMF. A wireless connection with AP910 that does not use PMF has weaker security than a wireless connection with AP300 that uses PMF.

T470 to T474 are the same as T70 to T74 in Figure 2, except that AP 910 is used. Here, the probe response for T474 does not include PMF information.

In this case, at T426 above, the PMF setting information 44 is changed from the setting "PMF Capable" to the setting "PMF Required." As described above, the setting "PMF Required" does not allow the establishment of a wireless connection without using PMF. In this case, AP910 is a PMF Disable AP. Therefore, AP910 notifies MFP10 that it will not use PMF in 4-way handshake communication. However, because MFP10 does not allow the establishment of a wireless connection without using PMF, the 4-way handshake communication fails. As a result, the establishment of a wireless connection between AP910 and MFP10 fails. Even in this case, a wireless connection is not established between the AP 910 and the MFP 10, preventing a third party from intercepting communications using the AP 910.

(Table showing the relationship between APs and MFPs; FIG. 9)
As shown in FIG. 9 , according to the PMF specification, there may be APs that operate in PMF Disable but do not have PR enabled, APs that operate in PMF Capable but do not have PR enabled, and APs that operate in PMF Required but have PR enabled.

On the other hand, there may be MFPs that operate with PMF Disable, WPA3-compatible MFPs that operate with PMF Capable, and WPA3-compatible MFPs that operate with PMF Required.

In this embodiment, the PMF setting information 44 of the MFP 10 is changed to the setting "PMF Required" (T426 in Figure 8). As a result, the MFP 10 can establish a wireless connection with either a PR-inactive AP operating in PMF Capable mode, or a PR-active AP operating in PMF Required mode. PMF is used in both cases. On the other hand, the MFP 10 cannot establish a wireless connection with a PR-inactive AP operating in PMF Disable mode (i.e., a wireless connection that does not use PMF).

(Correspondence)
PMF Capable and PMF Required are examples of the "first state (and fourth state)" and the "second state (and third state)", respectively.

(Third Example)
(Communication System 2; Figure 10)
In this embodiment, the MFP 10 uses Enterprise. As described above, Enterprise is a communication standard used by businesses, etc. Enterprise is provided not only in WPA3 but also in WPA2.

The communication system 2 of this embodiment is similar to the communication system 2 of the first embodiment, except that it includes authentication servers 210 and 310 and the content of the WPA3 setting information 42 is different.

Authentication servers 210 and 310 are authentication servers used by Enterprise. Authentication server 210 is used in the process of establishing a wireless connection with AP 200 and is connected to AP 200 via a wired LAN. Authentication server 310 is used in the process of establishing a wireless connection with AP 300 and is connected to AP 300 via a LAN (wired or wireless).

Furthermore, in this embodiment, the WPA3 setting information 42 indicates one of several settings, including the setting "SHA256 Any" and the setting "SHA256 Required." The setting "SHA256 Any" is a setting that allows the use of both a hash function that can be used in both WPA2 and WPA (e.g., SHA1) and the hash function "SHA256" that can be used in WPA3 but not in WPA2 or WPA, when communicating with the authentication server in Enterprise. In other words, when the WPA3 setting information 42 indicates the setting "SHA256 Any," the establishment of a wireless connection according to both WPA2 or WPA and WPA3 is permitted. Note that the hash function that can be used in WPA3 is not limited to SHA256, and may be, for example, SHA384 or SHA3.

On the other hand, the setting "SHA256 required" allows the use of the hash function "SHA256" when communicating with the authentication server in Enterprise, but does not allow the use of hash functions that can be used in both WPA2 and WPA. In other words, when the WPA3 setting information 42 indicates the setting "SHA256 required," the establishment of a wireless connection conforming to WPA3 is permitted, but the establishment of a wireless connection conforming to WPA2 or WPA is not permitted. Note that the setting "SHA256 required" may also allow the use of SHA384 and SHA3.

SHA256 is a hash function that outputs a return value with a length of 256 bits. The length of the return value of SHA256 is longer than the length of the return value of SHA1. The encryption strength of SHA256 is higher than that of SHA1.

(Specific case of this embodiment; Figure 11)
A specific case of this embodiment will be described with reference to Fig. 11. In the initial stage of this case, the WPA3 setting information 42 of the MFP 10 indicates the setting "SHA256 arbitrary" by default.

T510 to T514 are the same as T10 to T14 in Figure 2. Note that the WPA3 compatibility information in T514 includes information indicating the hash function "SHA256" used in communication with the authentication server. In T526, the MFP 10 changes the WPA3 setting information 42 from "SHA256 optional" to "SHA256 required."

T520 is the same as T20 in FIG. 2, except that the selection screen includes an input field for the user password used for authentication in the authentication server instead of an input field for the AP password. T522 is the same as T22 in FIG. 2, except that the user password "zzzz" stored in the authentication server 310 in association with the user name indicating the user of the MFP 10 is entered in the user password input field. T524 is the same as T24 in FIG. 2.

T730 is the same as T30 in Figure 2, except that OPEN authentication is performed instead of SAE authentication. In T731, association communication is performed with AP300.

At T732, the MFP 10 sends a Client Hello signal to the authentication server 310 via the AP 300. Communication between the MFP 10 and the AP 300 is encrypted in accordance with TLS (Transport Layer Security). The Client Hello signal is a signal that notifies the authentication server 210 that the MFP 10 has begun operating as a TLS client.

At T734, the MFP 10 receives a Server Hello signal from the authentication server 210 via the AP 300 in response to the Client Hello signal. The Server Hello signal is a signal that notifies the MFP 10 that the authentication server 310 has begun operating as a TLS server.

At T736, the MFP 10 performs EAP (Extensible Authentication Protocol) authentication communication with the authentication server 310 via the AP 300 in accordance with TLS. EAP authentication includes user authentication and key exchange. User authentication is communication in which the authentication server 210 authenticates the user of the MFP 10 using the user password received from the MFP 10. Key exchange is communication in which, if user authentication is successful, the authentication server 210 provides both the MFP 10 and the AP 300 with an encryption key to be used in the communication at T740, described below.

T740 is the same as T70 in Figure 3, except that the encryption key provided in EAP authentication is used. T750 is the same as T50 in Figure 2.

In this case, a malicious third party prepares an AP 900 and an authentication server 920 with the purpose of eavesdropping on communications. The authentication server 920 is a server that performs EAP authentication in accordance with WPA2. For example, the authentication server 920 performs EAP authentication using the hash function "SHA1."

T770 to T774 are the same as T70 to T74 in Figure 2. T776 is the same as T730 except that PSK authentication is performed. T778 and T780 are the same as T732 and T734 except that AP 900 and authentication server 920 are used.

In this case, at T526 above, the WPA3 setting information 42 is changed from the setting "SHA256 optional" to the setting "SHA256 required." As described above, the setting "SHA256 required" does not allow communication with the authentication server using the hash function "SHA1." In this case, the authentication server 920 uses the hash function "SHA1." Therefore, the authentication server 920 notifies the MFP 10 that the hash function "SHA1" will be used. However, because the MFP 10 does not allow the use of the hash function "SHA1," EAP authentication fails. As a result, the establishment of a wireless connection between the AP 900 and the MFP 10 fails. Even in this case, a wireless connection is not established between the AP 900 and the MFP 10, preventing a third party from intercepting communications using the AP 900.

(Correspondence)
SHA256 optional and SHA256 required are examples of the "first state (and fourth state)" and the "second state (and third state)", respectively.

(Fourth Example)
In this embodiment, the MFP 10 communicates with a management server that manages the status of the MFP 10. The communication between the MFP 10 and the management server is performed in accordance with TCP (Transmission Control Protocol). Furthermore, the communication between the MFP 10 and the management server is encrypted in accordance with TLS. For example, the MFP 10 periodically transmits information indicating the status of the MFP 10 (e.g., the amount of remaining ink, etc.) to the management server.

(Configuration of communication system 2; FIG. 12)
The communication system 2 of this embodiment is similar to the communication system 2 of the first embodiment except that it includes management servers 600 and 700 instead of the APs 200 and 300, and that the configuration of the MFP 10 is different.

Management server 600 supports TLS version 1.2. Management server 700 supports TLS version 1.3, which was developed after version 1.2. Management servers 600 and 700 are connected to LAN4, which is a wired LAN. Note that "1.3" is a number representing the latest version and is merely an example.

(Configuration of MFP 10; FIG. 12)
The MFP 10 of this embodiment is similar to the first embodiment except that it includes a LAN I/F 60 instead of the Wi-Fi I/F 16, and stores TLS setting information 50 instead of the WPA3 setting information 42. The LAN I/F 60 is an I/F for executing communication via the LAN 4, and is connected to the LAN 4. The MFP 10 of this embodiment also supports TLS version 1.3.

TLS setting information 50 indicates one of several settings, including the setting "TLS 1.3 not required" and the setting "TLS 1.3 required." The setting "TLS 1.3 not required" is a setting that allows the use of both TLS version 1.3 and versions of TLS prior to version 1.2. The setting "TLS 1.3 required" is a setting that allows the use of TLS version 1.3 but does not allow the use of versions of TLS prior to version 1.2.

(Specific case of this embodiment; Figure 13)
A specific case of this embodiment will be described with reference to Fig. 13. In the initial stage of this case, the TLS setting information 50 of the MFP 10 indicates the setting "TLS 1.3 not required" by default. Note that all of the following communications executed by the MFP 10 of this embodiment are executed via the LAN I/F 60. In the following, when describing communication-related processes, the phrase "via the LAN I/F 60" may be omitted.

In addition, this case assumes that a new management server 700 is installed in addition to the management server 600. In this case, the user enters the IP address of the management server 700 into the MFP 10 instead of the IP address of the management server 600.

In T810, the user operates the operation unit 12 of the MFP 10 to input an instruction to establish a TCP connection with the management server 700. For example, communication between the MFP 10 and the management server is performed periodically while the MFP 10 is powered on. A TCP-compliant connection with the management server 700 (hereinafter referred to as a TCP connection) is established when the MFP 10 is powered on after the IP address of the management server 700 is input. The instruction to power on the MFP 10 in T810 can be considered an instruction to establish a TCP connection with the management server 700.

At T812, the MFP 10 sends an ARP (Address Resolution Protocol) request addressed to the IP address of the management server 700. The ARP request is a signal requesting the MAC address of the management server.

At T814, the MFP 10 receives an ARP response from the management server 700 in response to the ARP request of T812, the ARP response including the MAC address MA1 of the management server 700. At T816, a TCP connection is established between the MFP 10 and the management server 700.

At T820, the MFP 10 uses the established TCP connection to send a Client Hello signal to the management server 700. At T820, the MFP 10 uses the established TCP connection to receive a Server Hello signal from the management server 700. The Server Hello signal includes information indicating that the management server 700 supports TLS version 1.3.

At T830, communication is performed between the MFP 10 and the management server 700 using the established TCP connection in accordance with TLS version 1.3. This communication includes, for example, sending information indicating the status of the MFP 10 to the management server.

Next, in T840, the MFP 10 disconnects the TCP connection of T816 in response to a predetermined user operation. The predetermined operation is, for example, turning off the power to the MFP 10.

In T842, the MFP 10 determines whether communication according to TLS version 1.3 has been performed in the past. In this case, communication according to TLS version 1.3 has been performed in T830. In this case, the MFP 10 determines that communication according to TLS version 1.3 has been performed in the past, and proceeds to processing T844. Note that if the MFP 10 determines that communication according to TLS version 1.3 has not been performed in the past, processing T844 is skipped.

At T844, the MFP 10 changes the TLS setting information 50 from "TLS 1.3 not required" to "TLS 1.3 required."

In this case, a malicious third party also prepares a management server 930 with the purpose of intercepting communications. The management server 930 does not support TLS version 1.3. For example, the management server 930 supports an older version (e.g., 1.2) that was established before version 1.3. With TLS, new security protocols are provided with each version update. Communications that comply with older versions of TLS that were established before version 1.3 have weaker security than communications that comply with TLS version 1.3.

The third party first disrupts communication between the management server 700 and the MFP 10, disconnecting the TCP connection with the management server 700. The MFP 10 detects the disconnection of the TCP connection at T872. To attempt to re-establish the TCP connection, the MFP 10 sends an ARP request addressed to the IP address of the management server 700 at T872. Here, the third party fraudulently sets the IP address of the management server 930 to the same IP address as the IP address of the management server 700. As a result, at T874, the MFP 10 receives an ARP response from the management server 930 that includes the MAC address MA2 of the management server 930.

In T876, a TCP connection is established between the MFP 10 and the management server 930. T880 is similar to T820, except that the management server 930 is used. T882 is similar to T822, except that the Server Hello signal includes information indicating that the management server 930 supports a version of TLS prior to version 1.3 (e.g., 1.2).

In this case, in T844 above, the TLS setting information 50 is changed to the setting "TLS 1.3 Request." As described above, the setting "TLS 1.3 Request" does not allow the use of TLS versions prior to version 1.2. In this case, the management server 930 supports TLS versions prior to version 1.2. Therefore, the MFP 10 does not allow communication in accordance with TLS version 1.3, and, for example, information indicating the status of the MFP 10 is not sent to the management server 930. This makes it possible to prevent third parties from intercepting communications using the management server 930.

(Table showing the relationship between the management server and MFPs; FIG. 14)
As shown in FIG. 14, there may be servers that support TLS versions prior to version 1.2, servers that support TLS versions prior to version 1.3, and servers that support only TLS version 1.3.

On the other hand, there may be MFPs that operate with TLS version 1.2 or earlier, MFPs that operate with TLS version 1.3 or earlier, and WPA3-compatible MFPs that operate only with TLS version 1.3.

In this embodiment, the TLS setting information 50 of the MFP 10 is changed to the setting "TLS 1.3 Request" (T844 in Figure 13). As a result, the MFP 10 can communicate using a TCP connection with either a server that supports TLS version 1.3 or earlier, or a server that only supports TLS version 1.3. On the other hand, the MFP 10 cannot communicate using a TCP connection with a server that supports TLS version 1.2 or earlier.

(Correspondence)
The LAN I/F 60 in FIG. 12 is an example of a "communication interface." The management server 700 and the management server 600 are examples of a "first external device" and a "second external device," respectively. TLS 1.3 not required and TLS 1.3 required are examples of a "first state (and fourth state)" and a "second state (and third state)," respectively. Version 1.3 and version 1.2 are examples of a "first version" and a "second version," respectively. TLS version 1.3 and TLS version 1.2 are examples of a "first communication standard" and a "second communication standard," respectively. The connection instruction T810 in FIG. 13 is an example of an "instruction to establish a first connection." T844 is an example of a process implemented by a "first change unit."

The above describes specific examples of the technology disclosed in this specification, but these are merely examples and do not limit the scope of the claims. The technology described in the claims includes various modifications and variations of the specific examples exemplified above. For example, the following modifications may be adopted.

(Variant 1) The processing of case C3 in Figure 4 does not need to be executed. In this variant, the "second change unit" can be omitted.

(Variant 2) The processing of Case C2 in Figure 3 does not have to be performed. Generally speaking, "the state of the communication device does not have to be maintained in the first state."

(Variant 3) T60 and T62 in Figure 2 do not need to be executed. In this variant, the "image processing execution unit," "establishment unit," "request reception unit," and "processing control unit" can be omitted.

(Variation 4) The "communication device" is not limited to the MFP 10, but may also be, for example, a printer, scanner, PC, or other terminal device.

(Variant 5) The "server" is not limited to a management server 600 that manages the status of the MFP 10, but may also be, for example, a mail server that sends e-mails in response to instructions from the MFP 10.

(Variation 6) In the above embodiment, the processes shown in Figures 2 to 14 are implemented by software (e.g., program 40), but at least one of these processes may also be implemented by hardware such as a logic circuit.

The following reference example is also new and useful. In a fourth embodiment, the MFP 10 sends an ARP request to the management server 700, triggered by the input of a TCP connection instruction after the input of the management server 700's IP address (T810, T812 in FIG. 13). Alternatively, the process of T810 may not be executed, and the MFP 10 may automatically send an ARP request to the management server 700 at a predetermined timing after the input of the management server 700's IP address. Generally speaking, the "first change unit" may be a predetermined timing while the communication device is in the first state, at which a first connection with a first external device via a communication interface should be established, and may change the state of the communication device from the first state to a second state different from the first state.

The technical elements described in this specification or drawings exhibit technical utility either alone or in various combinations, and are not limited to the combinations described in the claims at the time of filing. Furthermore, the technologies illustrated in this specification or drawings simultaneously achieve multiple objectives, and achieving one of those objectives is itself technically useful.
The features of the technology disclosed in this specification are listed below.
(Item 1)
A communication device,
a communication interface;
An operation unit;
a first change unit that changes a state of the communication device from the first state to a second state different from the first state when the operation unit receives an instruction to establish a first connection with a first external device via the communication interface while the communication device is in the first state,
the first state is a state in which both use of the first connection and use of a second connection with a second external device via the communication interface are permitted;
the second state is a state in which use of the first connection is permitted and use of the second connection is not permitted,
the first connection is a connection conforming to a first communication standard,
the second connection is a wireless connection conforming to a second communication standard different from the first communication standard;
the first change unit;
A communication device comprising:
(Item 2)
2. The communication device according to claim 1, wherein the first change unit changes the state of the communication device from the first state to the second state in response to an instruction to establish the first connection before the first connection with the first external device is established.
(Item 3)
2. The communication device according to claim 1, wherein the first change unit changes the state of the communication device from the first state to the second state after the first connection with the first external device is established in response to an instruction to establish the first connection.
(Item 4)
The communication device further comprises:
4. The communication device according to claim 1, further comprising: a second change unit that changes the state of the communication device from the second state to the first state when the operation unit receives an instruction to establish the second connection while the communication device is in the second state.
(Item 5)
the first external device and the second external device are access points;
5. The communication device according to claim 1, wherein the first connection and the second connection are wireless connections.
(Item 6)
the SSID (abbreviation of Service Set Identifier) of the wireless network formed by the first external device is the same as the SSID of the wireless network formed by the second external device;
The communication device further comprises:
an information receiving unit that receives, while the communication device is in the first state, standard information indicating a communication standard supported by each of one or more external devices present around the communication device;
6. The communication device according to item 5, wherein when the one or more external devices include both the first external device and the second external device, and the one or more standards information includes both first standards information indicating that the first external device supports the first communication standard and second standards information indicating that the second external device supports the second communication standard, the state of the communication device is maintained in the first state even when the operation unit receives an instruction to establish the first connection.
(Item 7)
the first communication standard includes WPA3 in the Wi-Fi standard;
7. The communication device according to claim 5, wherein the second communication standard includes a standard prior to WPA2 in the Wi-Fi standard.
(Item 8)
the first state includes a WPA3 Transition Mode according to the WPA3;
8. The communication device according to item 7, wherein the second state includes a WPA3 Only Mode according to the WPA3.
(Item 9)
the first state includes a state in which both a first authentication using a PSK (abbreviation of Pre-Shared Key) method that can be used in standards prior to WPA2 and a second authentication using an SAE (abbreviation of Simultaneous Authentication of Equals) method that can be used in WPA3 but cannot be used in standards prior to WPA2 are permitted;
9. The communication device according to claim 7, wherein the second state includes a state in which the first authentication is not permitted and the second authentication is permitted.
(Item 10)
the first state includes a state permitting use of both a first hash function that can be used in both the WPA3 and the standard before WPA2, and a second hash function that can be used in the WPA3 but cannot be used in the standard before WPA2;
8. The communication device according to claim 7, wherein the second state includes a state in which use of the first hash function is not permitted and use of the second hash function is permitted.
(Item 11)
the first communication standard and the second communication standard include a Wi-Fi standard;
the first communication standard includes PMF (short for Protected Management Frames),
the second communication standard does not include the PMF;
the first state includes a state indicated by PMF Capable;
7. The communication device according to claim 5, wherein the second state includes a state indicated by PMF Required.
(Item 12)
The communication device further comprises:
an image processing execution unit for executing specific image processing;
an establishment unit that establishes the first connection with the first external device when the operation unit receives an instruction to establish the first connection;
a request receiving unit that receives, after the first connection is established, a specific request for executing the specific image processing from the first external device via the communication interface using the first connection;
a processing control unit that causes the image processing execution unit to execute the specific image processing in accordance with the specific request;
12. The communication device according to any one of claims 1 to 11, comprising:
(Item 13)
the first external device and the second external device are servers,
the first communication standard includes a first version of TLS (Transport Layer Security) used in communication with the server;
the second communication standard includes a second version of the TLS established before the first version;
the first state includes a state in which use of both the first version and the second version is permitted;
5. The communication device according to claim 1, wherein the second state includes a state in which use of the first version is not permitted and use of the second version is permitted.
(Item 14)
14. The communication device of any one of claims 1 to 13, wherein a default state of the communication device after the communication device is powered on is the first state.
(Item 15)
A communication device,
a communication interface;
An operation unit;
when the operation unit receives an instruction to establish a first connection with a first external device via the communication interface, the operation unit operates the communication device in a third state;
a control unit that causes the communication device to operate in a fourth state when the operation unit receives an instruction to establish a second connection with a second external device via the communication interface,
the third state is a state in which use of the first connection is permitted and use of the second connection is not permitted,
the fourth state is a state in which use of both the first connection and the second connection is permitted,
the first connection is a connection conforming to a first communication standard,
the control unit, wherein the second connection is a connection conforming to a second communication standard different from the first communication standard;
A communication device comprising:
(Item 16)
1. A computer program for a communication device, comprising:
The communication device
a communication interface;
An operation unit;
A computer,
Equipped with
The computer program causes the computer to:
a first change unit that changes a state of the communication device from the first state to a second state different from the first state when the operation unit receives an instruction to establish a first connection with a first external device via the communication interface while the communication device is in the first state,
the first state is a state in which both use of the first connection and use of a second connection with a second external device via the communication interface are permitted;
the second state is a state in which use of the first connection is permitted and use of the second connection is not permitted,
the first connection is a connection conforming to a first communication standard,
the second connection is a wireless connection conforming to a second communication standard different from the first communication standard;
A computer program that functions as the first change unit.
(Item 17)
1. A computer program for a communication device, comprising:
The communication device
a communication interface;
An operation unit;
A computer,
Equipped with
The computer program causes the computer to:
when the operation unit receives an instruction to establish a first connection with a first external device via the communication interface, the operation unit operates the communication device in a third state;
a control unit that causes the communication device to operate in a fourth state when the operation unit receives an instruction to establish a second connection with a second external device via the communication interface,
the third state is a state in which use of the first connection is permitted and use of the second connection is not permitted,
the fourth state is a state in which use of both the first connection and the second connection is permitted,
the first connection is a connection conforming to a first communication standard,
The second connection is a connection conforming to a second communication standard different from the first communication standard.

2: communication system, 4: LAN, 10: MFP, 12: operation unit, 14: display unit, 16: Wi-Fi I/F, 20: print execution unit, 22: scan execution unit, 30: control unit, 32: CPU, 34: memory, 40: program, 42: WPA3 setting information, 44: PMF setting information, 50: TLS setting information, 100: terminal device, 200: AP, 210: authentication server, 300: AP, 310: authentication server, 600: management server, 700: management server, 800: AP, 850: MFP, 900: AP, 910: AP, 920: authentication server, 930: management server, MA1, MA2: MAC address

Claims (13)

A communication device,
a communication interface;
An operation unit;
a first change unit that changes a state of the communication device from the first state to a second state different from the first state when the operation unit receives an instruction to establish a first connection with a first external device via the communication interface while the communication device is in the first state,
the first state is a state in which both use of the first connection and use of a second connection with a second external device via the communication interface are permitted;
the second state is a state in which use of the first connection is permitted and use of the second connection is not permitted,
the first connection is a connection conforming to a first communication standard,
the second connection is a wireless connection conforming to a second communication standard having weaker security than the first communication standard;
the first change unit;
Equipped with
The first change unit changes the state of the communication device from the first state to the second state in response to an instruction to establish the first connection after the first connection with the first external device is established . The communication device further comprises:
2. The communication device according to claim 1, further comprising a second change unit that changes the state of the communication device from the second state to the first state when the operation unit receives an instruction to establish the second connection while the state of the communication device is the second state. the first external device and the second external device are access points;
The communication device according to claim 1 or 2 , wherein the first connection and the second connection are wireless connections. the SSID (abbreviation of Service Set Identifier) of the wireless network formed by the first external device is the same as the SSID of the wireless network formed by the second external device;
The communication device further comprises:
an information receiving unit that receives, while the communication device is in the first state, standard information indicating a communication standard supported by each of one or more external devices present around the communication device;
4. The communication device according to claim 3, wherein when the one or more external devices include both the first external device and the second external device, and the one or more standards information includes both first standards information indicating that the first external device supports the first communication standard and second standards information indicating that the second external device supports the second communication standard, the state of the communication device is maintained in the first state even when the operation unit receives an instruction to establish the first connection. the first communication standard includes WPA3 in the Wi-Fi standard;
The communication device according to claim 3 , wherein the second communication standard includes a standard that precedes WPA2 in the Wi-Fi standard. the first state includes a WPA3 Transition Mode according to the WPA3;
The communication device according to claim 5 , wherein the second state includes a WPA3 Only Mode according to the WPA3. the first state includes a state in which both a first authentication using a PSK (abbreviation of Pre-Shared Key) method that can be used in standards prior to WPA2 and a second authentication using an SAE (abbreviation of Simultaneous Authentication of Equals) method that can be used in WPA3 but cannot be used in standards prior to WPA2 are permitted;
The communication device according to claim 5 , wherein the second state includes a state in which the first authentication is not permitted and the second authentication is permitted. the first state includes a state permitting use of both a first hash function that can be used in both the WPA3 and the standard before WPA2, and a second hash function that can be used in the WPA3 but cannot be used in the standard before WPA2;
The communication device according to claim 5 , wherein the second state includes a state in which use of the first hash function is not permitted and use of the second hash function is permitted. the first communication standard and the second communication standard include a Wi-Fi standard;
the first communication standard includes PMF (short for Protected Management Frames),
the second communication standard does not include the PMF;
the first state includes a state indicated by PMF Capable;
The communication device according to claim 3 or 4 , wherein the second state includes a state indicated by PMF Required. The communication device further comprises:
an image processing execution unit for executing specific image processing;
an establishment unit that establishes the first connection with the first external device when the operation unit receives an instruction to establish the first connection;
a request receiving unit that receives, after the first connection is established, a specific request for executing the specific image processing from the first external device via the communication interface using the first connection;
a processing control unit that causes the image processing execution unit to execute the specific image processing in accordance with the specific request;
10. A communication device according to claim 1 , comprising: the first external device and the second external device are servers,
the first communication standard includes a first version of TLS (Transport Layer Security) used in communication with the server,
the second communication standard includes a second version of the TLS standard that was established before the first version;
the first state includes a state in which use of both the first version and the second version is permitted;
The communication device according to claim 1 , wherein the second state includes a state in which use of the second version is not permitted and use of the first version is permitted. The communication device of claim 1 , wherein a default state of the communication device after the communication device is powered on is the first state. 1. A computer program for a communication device, comprising:
The communication device
a communication interface;
An operation unit;
A computer,
The computer program causes the computer to:
a first change unit that changes a state of the communication device from the first state to a second state different from the first state when the operation unit receives an instruction to establish a first connection with a first external device via the communication interface while the communication device is in the first state,
the first state is a state in which both use of the first connection and use of a second connection with a second external device via the communication interface are permitted;
the second state is a state in which use of the first connection is permitted and use of the second connection is not permitted,
the first connection is a connection conforming to a first communication standard,
the second connection is a wireless connection conforming to a second communication standard having weaker security than the first communication standard;
functioning as the first change unit,
a first change unit that changes the state of the communication device from the first state to the second state in response to an instruction to establish the first connection after the first connection with the first external device is established;